Pathling versions before 2.0.0 are vulnerable to path traversal and SSRF attacks, which could allow unauthenticated attackers to compromise sensitive data and internal resources.

This issue encompasses both CWE-22 (Path Traversal) and CWE-918 (Server-Side Request Forgery). These vulnerabilities allow an unauthenticated attacker to traverse the file system and force the server to interact with unintended internal or external services.

With a CVSS score of 8.7, this vulnerability presents a high risk to the confidentiality and integrity of the system. Successful exploitation could allow an attacker to bypass security controls, exfiltrate sensitive clinical data, or pivot to internal network infrastructure.

Immediate Action: Update Pathling to version 2.0.0 or later to patch the underlying logic flaws.

Proactive Monitoring: Inspect application logs for unusual URL parameters or requests that deviate from normal operational behavior.

Compensating Controls: Deploy WAF rules to sanitize user-supplied input and block requests that contain path traversal characters or target internal IP ranges.

Public Exploit Available: Unknown

Given the potential for both file system access and SSRF, this vulnerability poses a substantial threat to the security of the Pathling platform. Organizations should verify their current version and upgrade to 2.0.0 immediately to mitigate these combined risks.